ARMing Your E-mail with Archiving

Most companies have learned the wisdom of backing up their e-mail, sometimes the hard way. Now, faced with growing regulatory pressures and shrinking message stores, some administrators are moving on to "arming" their messaging systems with software in the emerging category of ARM (archiving and records management).

Companies in already regulated industries such as financial services, government, telecom, and healthcare have been the earliest adopters of message archiving. With the recent passage of the Sarbanes-Oxley Act, however, regulatory requirements for e-mail and other records are broadening their reach into all publicly traded companies, contends IXOS Software President and CEO, Matthew Suffoletto.

"It isn't really clear yet, under Sarbanes-Oxley, which documents need to be preserved. But the new law has certainly ratcheted up the heat in corporate boardrooms," according to Suffoletto, whose company is one of the players in the ARM category. Other vendors in the message archiving market include Veritas Software, Educom, eManage, KVS, Assentor, Tumbleweed, and Zantaz.

Meanwhile, it's quite clear that in court decisions involving "legal discovery," many different companies are already getting hit by sanctions for failing to retain data.

ARM products help to solve these regulatory/legal issues by letting systems administrators manage messages and other records across the entire lifecycle, "from creation to destruction," maintains Gailene Nelson, a consulting analyst at Ferris Research.

ARM Benefits Include Reduced Backup Time and Increased Storage Space

Proponents also point to additional benefits ranging from reduced backup time and increased storage space to improved end user productivity. The USAF AMC, for example, turned to IXOS eCONserver for Microsoft Exchange as a way of freeing up more e-mail storage for its 65,000 end users.

According to Lt. Col. Dean Mallory, the AMC managed to reduce its MS Exchange store requirements by 65 percent, saving 450 gigabytes of storage. At the same time, the unit consolidated its Exchange servers from more than 90 servers housed at 12 distributed sites to 16 servers located at a single site. Backup time was reduced from almost a full day to just a few hours.

On the desktop productivity side, many ARM products allow for integrated management of e-mail, CRM, and help desk applications for faster retrieval of information through consolidated searches, according to Nelson.

Among ARM tools, lifecycle management extends from receipt or creation of the record through maintenance, use, and disposition. "Once the record exists, it can be classified, routed or retained, depending on how the content is analyzed and interpreted. Disposition actions are taken when the record is no longer needed for current business. Administrative, legislative or regulatory conditions or requirements determine when the record has reached this state. The record can be transferred, archived, or permanently destroyed," Nelson elaborated in a recent report.

Backup and other time-honored e-mail management methods are no longer enough, many experts say. "Organizations typically limit the size of a user's message store, because otherwise server backups and restores would take too long. So users either delete e-mails or archive them to personal Outlook folders that are normally stored on individual desktops," Nelson pointed out.

"This means that central e-mail backup processes don't work properly, because important e-mails are inaccessible. With ARM technology, a user can delete an e-mail or archive it locally, but a central copy is still kept." The products also allow central repositories to be searched by authorized users, including end users with the proper permissions.

"This is important because a lot of end users do like to hang on to some of their e-mails. They look through their e-mails to find names of contacts and to determine what was said to whom on a particular day," observed Michael D. Osterman, president and founder of Osterman Research.

Content Controls for Indexing and Information Retrieval

Typically, archiving software also includes "content controls" for automatic appraisal, classification, indexing, and retrieval of data based on specified criteria.

Some products are able to use keyword filtering to automatically remove spam and personal mail from the archiving process while retaining all communications with specified customers, for instance. Another feature present in some products is the ability to set expiration dates so that archived e-mails will automatically self-destruct at specified times.

With the passage of the Sarbanes-Oxley Act and mounting pressures from the courts around "legal discovery," archiving is likely to become more essential in the future. Passed in the wake of the Enron/Arthur Andersen scandal, Sarbanes-Oxley raises the specter of heavy fines and/or imprisonment against anyone who "knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct or influence" a government investigation or official proceeding. The law also prohibits destruction of computer- or paper-based records in "contemplation" of such an investigation or proceeding.

During the legal discovery process, on the other hand, opposing parties can ask each other to produce copies of evidence. "For example, plaintiffs suing a cigarette firm might request all emails containing the words 'illness' and 'cancer,'" Nelson illustrated. "Responding to such 'discovery' requests is extremely expensive and time-consuming when one has to manually sift through message store backups."

Demands on administrators from legal discovery are growing stronger. In Bills v. Kennecott Corp., back in the 1980s, the court ruled that "information stored in computers should be as freely discoverable as information not stored on computers." In a later suit, Long Island Diagnostic Imaging vs. Stony Brook Diagnostic Associates, the court dismissed an entire cross-complaint because of improper deletion of computer evidence on one of the parties' servers. In another case, RKI Inc. vs. Grimes, the court imposed sanctions on a company because an employee had improperly deleted data on his laptop.

...But Backup Still Predominant

Still, most companies haven't even started to move from backup to archiving yet. In a recent study by Osterman Research, 99% of organizations said they perform full backups of their messaging systems, with about 52 percent doing so daily, 45 percent weekly, and only two percent performing monthly backups.

Only 19% of respondents, though, replied "yes" to the question, "Do you have different levels of backup or archiving for your messaging servers based on different retention requirements for various types of data?"

"Administrators are really all over the map," Osterman said in an interview. "A lot of them are still holding on to all e-mail for 60 to 90 days, and then getting rid of it. Others are starting to realize that not all e-mail is the same. Some stuff -- such as luncheon invitations -- you can throw away. Other stuff -- such as messages dealing with customers or personnel issues -- you might need to keep."

Perhaps some organizations are just waiting for the dust to settle around the confusion caused by Sarbanes-Oxley. In the new law, "document retention is governed by three provisions [which are not consistent]: a seven-year period for all documents that support a final report [not effective until a firm is registered]; a five-year period in criminal provisions of the Act that covers all audit and review workpapers [this appears to be effective immediately; the SEC will be releasing rules relating to documents covered by this section]; and an undefined category of documents in connection with the board's inspection program which awaits board rulemaking as to its nature and scope," according to a recent Web posting by the AICPA, a professional organization for CPAs.

Archiving deployments will really ramp up, though, only when more organizations start to "feel the pain," Osterman predicted. "If you're a manufacturer, and you see another manufacturer get socked with a heavy fine -- that's when you'll turn around."

"The government hasn't really tightened the screws on that many companies, yet, and there's a lot of noncompliance," Nelson concurred during an interview.
"But the industry is still really in its infancy, and some of the vendors have a long way to go, too, in communicating the benefits of their products."